Tall latte, hold the malware

There’s nothing like coffee one-upmanship to make the blood boil.

“You’re still drinking lattes? With actual milk from a cow? Good grief, where have you been?”

Nowadays, though, it seems that coffee one-upmanship is no longer enough to secure the seemingly coveted ‘hippest person in the café’ crown. Now that portable devices are actually portable, cafés and other public spaces seem to be prime territory for people keen to show off their technological gadgetry.

I’ve been keeping an eye out during my recent café trips – doppio, natch – and usually around half of the customers are tapping away on notebooks, ultra-portables and tablet devices. This is, admittedly, in tech-enamoured Tokyo, but the use of truly portable and network-capable machines is clearly going to increase as specs go up and costs come down. Cafés are finding that free Wi-Fi access is now expected by their gizmo-toting customers.

Early adopters of technology tend to be more technologically savvy and hence more security-conscious than many, but with portable Wi-Fi-capable devices now entering the mainstream, we’re sure to see security issues arise. So, how best to stay safe in the great outdoors?The usual precautions to take when using untrusted Wi-Fi access points apply equally here: not entering sensitive data when browsing the Web, assuming that connections are being eavesdropped on and employing the use of SSL when possible. Tunnelling business-related or highly sensitive communications over a VPN can never be a bad thing either (unless, of course, you’re trying to listen in).

Take advantage of WEP or (preferably) WPA encryption if it is offered by the café access point. Ask staff for the key, or, alternatively, check the piece of paper you were probably just about to throw away; some cafés print WEP/WPA keys on receipts, ready to be used by customers. Of course, these encryption techniques are not perfect, but their use may help to deter casual or opportunistic attackers.

Remember that, although you may think you are connected to your friendly café-owner’s network, the reality may be very different. An ‘evil twin’ access point, capable of DNS spoofing and a whole host (pun intended) of other nastiness, can be set up by anyone with a modicum of Wi-Fi knowledge. Still trust that guy sitting next to you with the laptop and the latte? Me neither.

It almost goes without saying that the use of a firewall is essential when you’re surrounded by potential bad guys. If you use Bluetooth devices, set them to be ‘hidden’ and not ‘discoverable’. If you do not use Bluetooth, turn it off altogether.

Ultra-portables are likely to be exposed to potentially hostile environments, and as such should be tricked out with security suites and kept up-to-date with updates and vendor patches. Of course, mobile PCs are vulnerable to the same viruses, Trojans and worms as traditional ‘big white box’ computers, and what malware author wouldn’t want a network of ultra-portable bots under his command, sending spam or attacking other systems from ever-changing locations?

It’s a good idea to run file encryption software on portable devices – which need not mean a significant performance hit – in case of loss or theft. Although it may sound obvious, the easiest way to deter thieves is to ensure that your machine is with you at all times; I have seen, on many an occasion, people getting up and leaving their expensive-looking devices on the table unattended. Yoink! Ultra-portable means ultra-stealable, and as such you may want to consider engraving or marking equipment with a UV pen. One further thing to do is to ensure that files that exist only on a portable are backed up ‘back at base’. Mobile devices are easily broken, and, sadly, experience has taught this writer that coffee and keyboards don’t play well together.

With a bit of care in the café, mobile computing needn’t be fraught with risk. The café ultra-portable fashion show, however, is a different ball game altogether. Keyboard or touch-screen? Black or white? Decisions as critical as these are best left to you.

Henry Bell is an Information Developer at Symantec Security Response